Couple of points on this. If the requirement is continuous checking, you must use the persistent agent.
You could do the following:
1. User logs into 802.1x SSID (user/pass)
2. User is redirected to the onboarding page where they are given instructions to download the agent and also complete the onboarding process. While you can deploy the agent with Windows, that is specific to that OS. We can make this specific to OS X and Windows onboard pages as well in ClearPass 6.5+. You can add your own HTML to add instructions to download the agent for OnGuard. In this way, the OnGuard agent is more or less integrated into the OnBoarding workflow.
Another option - you can redirect them to a web page to JUST download the agent POST onboarding but that is another step the user would have to take to get the agent. You can also leverage this workflow IF the posture state is UNKNOWN post onboarding meaning that the user "forgot" to download the agent.
See screenshot: